Overview

overview

10

Static

static

10

fbbc0e3624...34.exe

windows7-x64

10

fbbc0e3624...34.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eda1749ecd5d30aebc623e3ed3679e33.bin

  • Size

    62KB

  • Sample

    240608-e29lnshh55

  • MD5

    fd4ae3e88b42f2742b7f4a4b6d948e51

  • SHA1

    cf973b850cd04e00e985031ed1c3e13bed0de297

  • SHA256

    206e11f497b62d8d7b39cbbd75d62a71989db5bb700990ec03852549d84bb397

  • SHA512

    a3bf624f172ae74cf0fc403457ef847f7654dfe8b21ac481fad195516aac23718018e782b861958fd20e9d559fd8f1fe430dd20e0cea26a7a2a4382474bf96fd

  • SSDEEP

    1536:CKjXG/yfx7CS1suZYS1AkLzIMkLWRkT2/Bu7OLY/b13xXw:Feyf1CMsKAkXDwakypu70Y/bfA

Score
10/10
xehookexecutionspywarestealer

Malware Config

Targets

    • Target

      fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134.exe

    • Size

      149KB

    • MD5

      eda1749ecd5d30aebc623e3ed3679e33

    • SHA1

      36bac5bad466a15b4385bf1bc07e681682c277cd

    • SHA256

      fbbc0e3624e3fbe0cedff57c1e63f17855adb1c6b9fb83db9aec86b34e537134

    • SHA512

      d08fae35eb98f3d7c6a1dbff195510502d3c382cb2b59d8d1b46c44a5369924ac54bd1160808a28518bf121070b03c98471881f560e69f26df90be6b9b7320db

    • SSDEEP

      3072:mF1w5ZnALHQ1h18DI1+u5hIBzl+J3fu3/Xd35qVpUnTiuPA9QPOFqGxB1/D:UqjnALHQ1h18DI1++kObVpUnTiuPA9Qm

    Score
    10/10
    xehookspywarestealerexecution

    • Detect Xehook Payload

    • Xehook stealer

      Xehook is an infostealer written in C#.

      stealerxehook

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks